Healthcare’s Guide to Vulnerability Management
What Do Healthcare Leaders Think about Vulnerability Management?
Healthcare organizations are under mounting pressure to manage cybersecurity vulnerabilities across an increasingly complex technology ecosystem. Traditional IT environments now coexist with cloud platforms, cyber-physical systems, and thousands of network-connected medical devices—many of which were never designed with modern cybersecurity threats in mind.
CHIME Insights
To better understand how healthcare leaders are managing this reality, members of the College of Healthcare Information Management Executives (CHIME) recently participated in a survey focused on vulnerability management across IT and medical/IoT environments. Their responses reveal both progress and persistent gaps—and point clearly to the need for a more unified approach. The data below reflect the survey results conducted by CHIME.
Respondents included CIOs, CISOs, clinical and digital leaders from ambulatory organizations, and large multi-hospital systems.
Vulnerability management is an enterprise risk issue, not just an IT function
How respondents summarized their sentiment on vulnerability management
The Healthcare Cyber Risk Landscape
Healthcare organizations manage vulnerabilities across a rapidly expanding ecosystem:
- IT infrastructure
- Cloud environments
- Cyber-physical systems
- Connected medical devices
Many technologies were not built for today’s threat landscape—creating risk to patient safety, operations, and compliance.
Top Vulnerability Management Challenges
Healthcare leaders report:
- Limited budget and staffing
- Outdated or unsupported systems
- High volumes of vulnerabilities
- Difficulty prioritizing risk
- Patch testing and deployment delays
The imbalance: vulnerabilities are discovered faster than they can be remediated.
Scanning Alone Isn’t Enough
Most organizations scan:
- Weekly
- Quarterly
- Continuously
Reality:
More scanning does not equal less risk if findings aren’t actionable or aligned with clinical constraints.
The Biggest Gap: IT & Medical Devices
Only 36% have fully integrated vulnerability programs.
Key barriers:
- Medical device patching limitations
- No unified asset inventory
- IT and clinical engineering silos
- Limited remediation resources
Confidence Is Cautious
- 84% are somewhat confident
- Only 8% are very confident
Programs may work under normal conditions—but are stressed by zero-days, ransomware, and urgent disclosures.
What Will Close the Gap
Healthcare leaders say prioritizing these actions will improve outcomes
- Look to create a single, unified asset inventory
- Unify vulnerability management with tools spanning IT and medical devices
- Create a formal cross-department governance to educate on risk and risk remediation actions
- This problem is not declining, so find a way to optimize and increase remediation resource effectiveness
- Collectively work for greater vendor accountability
Updated: May, 2026
Contents:
What Do Healthcare Leaders Think about Vulnerability Management
Status Quo Can’t Keep Up with Vulnerability Exploitation
AI Vulnerability Discovery – Clearwater Advisory
Vulnerability Management Trend Report for Healthcare
Unified Vulnerability Management Program from Clearwater
Reference: Vulnerability Management Requirements Across Compliance Standards…
Ready to get serious about vulnerability exposure risk?
Navigating a Path Forward with a Program
Healthcare organizations are under mounting pressure to manage cybersecurity vulnerabilities across an increasingly complex technology ecosystem. Traditional IT environments now coexist with cloud platforms, cyber-physical systems, and thousands of network-connected medical devices—many of which were never designed with modern cybersecurity threats in mind.
The CHIME findings highlight a dangerous imbalance. Healthcare organizations are discovering vulnerabilities faster than they can reasonably assess or remediate them—especially when clinical constraints limit patching or downtime. Traditional scan-and-patch models struggle in environments where patient care cannot be interrupted.
The CHIME survey makes one thing clear: healthcare organizations understand the risk—but need help operationalizing solutions at scale. Vulnerability management must evolve from a reactive, resource-draining process into a proactive, continuously improving risk management program.
Status Quo Can’t Keep Up with Vulnerability Exploitation
Common Vulnerabilities and Exposures (CVE) Growth
Published CVEs rose by roughly 20% from 2024 to 2025, expanding the attack surface and increasing the workload for vulnerability management teams.
This increase reflects broader disclosure participation, expanded CNA coverage, and backlog reductions in scoring pipelines. Counts may vary due to withdrawn CVEs and NVD timing differences.
CVE Numbering Authority (CNA) Growth
CVE Numbering Authorities (CNAs) are approved organizations that assign CVE IDs within defined technology scopes. In 2025, the global CNA community grew by approximately 6%, expanding vulnerability coverage and accelerating disclosure across vendors and platforms.
Known Exploited Vulnerability (KEV) Growth
Known Exploited Vulnerabilities (KEVs) are software and hardware flaws that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed are actively being used in real-world attacks. Between 2024 and 2025, the KEV catalog expanded by approximately 20%, underscoring the growing pace of proven exploitation.
Clearwater Advisory
AI-Driven Vulnerability Discovery
This signals a structural shift in vulnerability discovery. AI models are finding and enabling the exploitation of software flaws faster than human teams can respond.
Vulnerability Management Trend Report for Healthcare
Which Vulnerabilities Pose the Highest Risk?
How am I doing compared to other like healthcare businesses?
What’s the current trend for Critical vulnerabilities?
Vulnerability Management across the healthcare industry is fraught with complexity exacerbated by a landscape of changing exposure risk. Healthcare data, innovation, and patient care availability are all at risk when vulnerabilities can be exploited.
Not all types of organizations across the healthcare ecosystem are the same. Clearwater’s report is the first of its kind that breaks down the trends broken out by healthcare market segments.
View the ups and downs of how healthcare organizations deal with all vulnerabilities month by month. Critical vulnerability finding trends show how these contribute to the running exposure risk in healthcare.
Healthcare environments create a vast attack surface that requires constant risk
management. Cyberattacks targeting sensitive health data, aiming to disrupt patient
care or infiltrate a healthcare supply chain, rely on vulnerability exposures to facilitate
their tactics. Security leaders in healthcare are keen to know where they stand as
compared to like organizations when it comes to vulnerability management, whether it is
performed in-house or with a managed security service provider (MSSP).
Ready to get serious about vulnerability exposure risk?
Clearwater’s Unified Vulnerability Management Program
- Unified visibility across IT, MedTech, and cyber-physical systems helps reduce operational complexity and fragmented risk management
- Vulnerability prioritization is guided by healthcare expertise and an understanding of patient care and clinical operational risk
- 24/7 monitoring and expert guidance help teams stay ahead of emerging threats without placing additional burden on internal resources
- We work alongside your team with practical remediation recommendations and risk-mitigating actions to help strengthen resilience and reduce exposure
Move beyond fragmented controls toward a more resilient, defensible, and patient-centered security posture with Clearwater Managed Security Services.
Reference
Vulnerability Management Requirements
Across Compliance Standards
Every compliance and regulatory guide for healthcare organizations has a vulnerability management requirement, yet vulnerability risk continues to grow. Here is a recap of the security and compliance frameworks and how they provide guidance for vulnerability management.
Common Requirements Across All Standards and Guidelines:
- Vulnerability identification
- Risk-based prioritization
- Timely remediation or mitigation
- Ongoing monitoring
- Documented governance
Compliance Standards and References to Vulnerability Management
HIPAA (Security Rule)
Requirement
Identify, assess, and reduce risks to ePHI.
References
- 45 CFR §164.308(a)(1)(ii)(A) – Risk Analysis
- 45 CFR §164.308(a)(1)(ii)(B) – Risk Management
- 45 CFR §164.308(a)(5)(ii)(B) – Malicious Software
- 45 CFR §164.308(a)(8) – Evaluation
HITECH Act
Requirement
Prevent and reduce breach exposure through reasonable safeguards.
References
- §13402 – Breach Notification
- §13404 – Business Associate Liability
- §13411–13412 – Enforcement & Penalties
CMMC
Requirement
Scan, track, and remediate system vulnerabilities.
References
- RA.1.001 – Identify Vulnerabilities
- RA.2.143 – Scan & Remediate
- RA.3.144 – Risk Analysis
- SI.2.145 – Flaw Remediation
HHS 405(d) (HICP)
Requirement
Healthcare-specific vulnerability management best practices.
References
- Practice #2 – Vulnerability Management
HITRUST CSF
Requirement
Formal, documented vulnerability management program.
References
- 10.1 – Technical Vulnerability Management
- 09.2 – Risk Management
- 01.a – Asset Inventory
SOC 2 (Trust Services Criteria)
Requirement
Identify, monitor, and remediate security vulnerabilities.
References
- CC3.2 – Risk Identification
- CC4.1 – Monitoring
- CC7.1 – Vulnerability Detection
- CC7.2 – Security Monitoring
PCI DSS 4.0
Requirements
- Emphasizes continuous risk assessment and targeted risk analysis rather than only periodic checks.
- Introduces greater flexibility in how requirements are met, but raises evidence and testing expectations.
- Makes explicit the need to define remediation timelines based on risk and to document compensating controls when chosen.
References
- Requirement 6.1 – Identify security vulnerabilities and assign a risk ranking.
- Requirement 6.2 – Ensure systems are protected from known vulnerabilities by installing applicable vendor-supplied security patches in a timely manner.
- Requirement 6.3.1 (PCI DSS 4.0) – Perform targeted risk analysis to determine remediation timelines.
- Requirement 6.4 – Follow change-control processes for system and application changes (includes testing and validation).
- Requirement 11.2.1 – Quarterly internal vulnerability scans.
- Requirement 11.2.2 – Quarterly external vulnerability scans by an Approved Scanning Vendor (ASV).
- Requirement 11.2.3 – Re-scan after remediation to validate fixes.
- Requirement 11.5 – File integrity monitoring (to detect unauthorized changes/exploitation).
- Requirement 12.3.1 – Defined roles and responsibilities for security (supports accountable remediation processes).